raccoon | 65ebd52ba08105df32e2427168357d33c7deca9feed6d78540fa38aafc8e8277

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211104
submitted
14/11/2021, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1032e43ef6e65285926c4d7fe21299b8.exe
Size 449KB
Sample211114-fbpn9afhd3
SHA256 65ebd52ba08105df32e2427168357d33c7deca9feed6d78540fa38aafc8e8277
MD5 1032e43ef6e65285926c4d7fe21299b8
SHA1 019b6c26f68d31389ab385b1029a24c0f70ec74a
SHA512 338796602ed74a9bf670927d6e1e70507ba5467b4dd15abde3c49f473ea1d44179890a9c3515981f163ed08cffe4205923c1596b284cacfd0746f9b4795c9670
MD5 SHA1 SHA512

Score

10^/10

raccoon 675718a5f2ce6d3cacf6cb04a512f5637eae995f stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1148	1892	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe
1148	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1148	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1148	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1148	1892	1032e43ef6e65285926c4d7fe21299b8.exe	28
PID 1892 wrote to memory of 1148	1892	1032e43ef6e65285926c4d7fe21299b8.exe	28
PID 1892 wrote to memory of 1148	1892	1032e43ef6e65285926c4d7fe21299b8.exe	28
PID 1892 wrote to memory of 1148	1892	1032e43ef6e65285926c4d7fe21299b8.exe	28

C:\Users\Admin\AppData\Local\Temp\1032e43ef6e65285926c4d7fe21299b8.exe
"C:\Users\Admin\AppData\Local\Temp\1032e43ef6e65285926c4d7fe21299b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-60-0x0000000001C80000-0x0000000001D11000-memory.dmp

Download

memory/1892-55-0x0000000076761000-0x0000000076763000-memory.dmp

Download

memory/1892-57-0x00000000002F0000-0x000000000037F000-memory.dmp

Download

memory/1892-56-0x00000000002A0000-0x00000000002EF000-memory.dmp

Download

memory/1892-58-0x0000000000400000-0x0000000000491000-memory.dmp

Download